thunderbolt storage not be auto mounted while secureboot is enabled and already protected by DMAR

[alex-tu-cc]

Tested on Ubuntu Focal, while secureboot enabled and DMAR supported. It does not need a user authentication so a block device will shown in /dev while user attach a thunderbolt storage.

But the attached thunderbolt storage will not be auto mounted. So far, user need to mount it manually by command.

[tbzatek]

There might be issues identifying the device as internal/removable. Anyway, can you please post output of udisksctl dump and dmesg? Are you plugging the device in after boot or before?

[alex-tu-cc]

Hi, I plugged the thunderbolt storage after boot. Please refer to the dmesg and udiskctl dump after plugged thunderbolt storage.

[alex-tu-cc]

@tbzatek Any other information that you need?

[tbzatek]

@alex-tu-cc I cannot access the dumps unless I register. Could you please post them here as attachments?

[alex-tu-cc]

@tbzatek sorry that pastebin wasn't that convenient. Please refer to the following attachment that I copied from the same comment. dmesg.txt udiskctl_dump.txt

[khfeng]

This patch should solve the issue: https://lkml.org/lkml/2022/1/11/1226

[tbzatek]

This patch should solve the issue: https://lkml.org/lkml/2022/1/11/1226

FYI, the UDisks hint doesn't necessarily come from one place, if there's something specific as returned by the NVMe device itself, we could use it.

[tbzatek]

Can you also post nvme id-ctrl -H /dev/nvme1 please?

[khfeng]

This patch should solve the issue: https://lkml.org/lkml/2022/1/11/1226

FYI, the UDisks hint doesn't necessarily come from one place, if there's something specific as returned by the NVMe device itself, we could use it.

It's just regular NVMe. However, we can still go up the hierarchy and check the physical device's removable sysfs attribute as predicate. This should be more future proof if the maintainer intends to remove GENHD_FL_REMOVABLE from USB storage.

I can come up with a patch if you don't mind.

[khfeng]

Can you also post nvme id-ctrl -H /dev/nvme1 please?

NVME Identify Controller:
vid       : 0x1dee
ssvid     : 0x126f
sn        : HBSD28232000029     
mn        : HP Portable SSD P800 256GB              
fr        : SVN127  
rab       : 6
ieee      : 000000
cmic      : 0
  [3:3] : 0	ANA not supported
  [2:2] : 0	PCI
  [1:1] : 0	Single Controller
  [0:0] : 0	Single Port

mdts      : 6
cntlid    : 0x1
ver       : 0x10201
rtd3r     : 0x7a120
rtd3e     : 0x1e8480
oaes      : 0x200
[14:14] : 0	Endurance Group Event Aggregate Log Page Change Notice Not Supported
[13:13] : 0	LBA Status Information Notices Not Supported
[12:12] : 0	Predictable Latency Event Aggregate Log Change Notices Not Supported
[11:11] : 0	Asymmetric Namespace Access Change Notices Not Supported
  [9:9] : 0x1	Firmware Activation Notices Supported
  [8:8] : 0	Namespace Attribute Changed Event Not Supported

ctratt    : 0
  [9:9] : 0	UUID List Not Supported
  [7:7] : 0	Namespace Granularity Not Supported
  [5:5] : 0	Predictable Latency Mode Not Supported
  [4:4] : 0	Endurance Groups Not Supported
  [3:3] : 0	Read Recovery Levels Not Supported
  [2:2] : 0	NVM Sets Not Supported
  [1:1] : 0	Non-Operational Power State Permissive Not Supported
  [0:0] : 0	128-bit Host Identifier Not Supported

rrls      : 0
crdt1     : 0
crdt2     : 0
crdt3     : 0
oacs      : 0x16
  [9:9] : 0	Get LBA Status Capability Not Supported
  [8:8] : 0	Doorbell Buffer Config Not Supported
  [7:7] : 0	Virtualization Management Not Supported
  [6:6] : 0	NVMe-MI Send and Receive Not Supported
  [5:5] : 0	Directives Not Supported
  [4:4] : 0x1	Device Self-test Supported
  [3:3] : 0	NS Management and Attachment Not Supported
  [2:2] : 0x1	FW Commit and Download Supported
  [1:1] : 0x1	Format NVM Supported
  [0:0] : 0	Security Send and Receive Not Supported

acl       : 4
aerl      : 7
frmw      : 0x14
  [4:4] : 0x1	Firmware Activate Without Reset Supported
  [3:1] : 0x2	Number of Firmware Slots
  [0:0] : 0	Firmware Slot 1 Read/Write

lpa       : 0xf
  [3:3] : 0x1	Telemetry host/controller initiated log page Supported
  [2:2] : 0x1	Extended data for Get Log Page Supported
  [1:1] : 0x1	Command Effects Log Page Supported
  [0:0] : 0x1	SMART/Health Log Page per NS Supported

elpe      : 255
npss      : 4
avscc     : 0
  [0:0] : 0	Admin Vendor Specific Commands uses Vendor Specific Format

apsta     : 0x1
  [0:0] : 0x1	Autonomous Power State Transitions Supported

wctemp    : 343
cctemp    : 353
mtfa      : 50
hmpre     : 0
hmmin     : 0
tnvmcap   : 0
unvmcap   : 0
rpmbs     : 0
 [31:24]: 0	Access Size
 [23:16]: 0	Total Size
  [5:3] : 0	Authentication Method
  [2:0] : 0	Number of RPMB Units

edstt     : 5
dsto      : 1
fwug      : 0
kas       : 0
hctma     : 0x1
  [0:0] : 0x1	Host Controlled Thermal Management Supported

mntmt     : 303
mxtmt     : 348
sanicap   : 0x2
  [31:30] : 0	Additional media modification after sanitize operation completes successfully is not defined
  [29:29] : 0	No-Deallocate After Sanitize bit in Sanitize command Supported
    [2:2] : 0	Overwrite Sanitize Operation Not Supported
    [1:1] : 0x1	Block Erase Sanitize Operation Supported
    [0:0] : 0	Crypto Erase Sanitize Operation Not Supported

hmminds   : 0
hmmaxd    : 0
nsetidmax : 0
anatt     : 0
anacap    : 0
  [7:7] : 0	Non-zero group ID Not Supported
  [6:6] : 0	Group ID does not change
  [4:4] : 0	ANA Change state Not Supported
  [3:3] : 0	ANA Persistent Loss state Not Supported
  [2:2] : 0	ANA Inaccessible state Not Supported
  [1:1] : 0	ANA Non-optimized state Not Supported
  [0:0] : 0	ANA Optimized state Not Supported

anagrpmax : 0
nanagrpid : 0
sqes      : 0x66
  [7:4] : 0x6	Max SQ Entry Size (64)
  [3:0] : 0x6	Min SQ Entry Size (64)

cqes      : 0x44
  [7:4] : 0x4	Max CQ Entry Size (16)
  [3:0] : 0x4	Min CQ Entry Size (16)

maxcmd    : 0
nn        : 1
oncs      : 0x5f
  [7:7] : 0	Verify Not Supported
  [6:6] : 0x1	Timestamp Supported
  [5:5] : 0	Reservations Not Supported
  [4:4] : 0x1	Save and Select Supported
  [3:3] : 0x1	Write Zeroes Supported
  [2:2] : 0x1	Data Set Management Supported
  [1:1] : 0x1	Write Uncorrectable Supported
  [0:0] : 0x1	Compare Supported

fuses     : 0
  [0:0] : 0	Fused Compare and Write Not Supported

fna       : 0
  [2:2] : 0	Crypto Erase Not Supported as part of Secure Erase
  [1:1] : 0	Crypto Erase Applies to Single Namespace(s)
  [0:0] : 0	Format Applies to Single Namespace(s)

vwc       : 0x1
  [0:0] : 0x1	Volatile Write Cache Present

awun      : 0
awupf     : 0
nvscc     : 0
  [0:0] : 0	NVM Vendor Specific Commands uses Vendor Specific Format

nwpc      : 0
  [2:2] : 0	Permanent Write Protect Not Supported
  [1:1] : 0	Write Protect Until Power Supply Not Supported
  [0:0] : 0	No Write Protect and Write Protect Namespace Not Supported

acwu      : 0
sgls      : 0
 [1:0]  : 0	Scatter-Gather Lists Not Supported

mnan      : 0
subnqn    : 
ioccsz    : 0
iorcsz    : 0
icdoff    : 0
ctrattr   : 0
  [0:0] : 0	Dynamic Controller Model

msdbd     : 0
ps    0 : mp:9.00W operational enlat:0 exlat:0 rrt:0 rrl:0
          rwt:0 rwl:0 idle_power:- active_power:-
ps    1 : mp:4.60W operational enlat:0 exlat:0 rrt:1 rrl:1
          rwt:1 rwl:1 idle_power:- active_power:-
ps    2 : mp:3.80W operational enlat:0 exlat:0 rrt:2 rrl:2
          rwt:2 rwl:2 idle_power:- active_power:-
ps    3 : mp:0.0450W non-operational enlat:2000 exlat:2000 rrt:3 rrl:3
          rwt:3 rwl:3 idle_power:- active_power:-
ps    4 : mp:0.0040W non-operational enlat:6000 exlat:8000 rrt:4 rrl:4
          rwt:4 rwl:4 idle_power:- active_power:-

[tbzatek]

Thanks for the output, I don't see anything specific around removable capability (unsurprisingly).

Thinking about this in broader view, we might perhaps add new "thunderbolt" value to the org.freedesktop.UDisks2.Drive.ConnectionBus property. And then add support for ejecting if there's such functionality for Thunderbolt devices (simple write to the delete/remove sysfs node?)

Anyway, walking the device hierarchy up and checking capabilities there might be the way to go. Could you also please post udevadm info -a /dev/nvme1 to see how the hierarchy looks like? I don't have any external NVMe SSD available here, just the TB3 ports on my MacBook.

[khfeng]

Thanks for the output, I don't see anything specific around removable capability (unsurprisingly).

Thinking about this in broader view, we might perhaps add new "thunderbolt" value to the org.freedesktop.UDisks2.Drive.ConnectionBus property. And then add support for ejecting if there's such functionality for Thunderbolt devices (simple write to the delete/remove sysfs node?)

Anyway, walking the device hierarchy up and checking capabilities there might be the way to go. Could you also please post udevadm info -a /dev/nvme1 to see how the hierarchy looks like? I don't have any external NVMe SSD available here, just the TB3 ports on my MacBook.

I agree this is to way to go, especially when maintainer mentioned USB storages shouldn't have GENHD_FL_REMOVABLE applied, so check the physical device's removable sysfs attr is the most reliable and scalable way to deal with this issue.